Miranda Hooker (hookerm@pepperlaw.com) is a Partner in the Boston office of Pepper Hamilton. Christen Tuttle (tuttlec@pepperlaw.com) is a Partner and Ying Zeng (zengy@pepperlaw.com) is an Associate in the Philadelphia office of Pepper Hamilton.
The opioid epidemic is one of the top enforcement priorities for the U.S. Department of Justice (DOJ). In October 2018, former Attorney General Jeff Sessions referred to the opioid epidemic as the “deadliest drug crisis in American history”[1] when he announced DOJ’s plan to counter the issue through increased enforcement of the country’s drug laws. If recent history is a guide, hospitals may soon find themselves in the government’s crosshairs, as the Controlled Substances Act (CSA)[2] provides for civil penalties for drug division and other recordkeeping violations, and is proving to be a powerful tool in the government’s arsenal.
The Controlled Substances Act
In recent years, the government has increased its civil enforcement efforts against hospitals and health systems for violations of the CSA, often in record-breaking amounts.[3] This article provides an overview of the CSA, examines recent enforcement actions, and offers suggestions on how to mitigate opioid diversion and enforcement risks.
General structure of the CSA
The CSA is the main federal statute that regulates the lawful production, possession, use, distribution, and importation of certain controlled substances. In general, the CSA establishes a scheduling system in which controlled substances are placed into five categories based on medical use, potential for abuse, and safety or dependence liability. The CSA further states that any individual or entity that handles controlled substances must register with the Drug Enforcement Administration (DEA). Each registrant is subject to detailed recordkeeping, security, and reporting requirements. The purpose of the CSA is to create a “closed system” of distribution, which helps to “ensure that all controlled substances are accounted for from their creation until their dispensing or destruction”[4] and to minimize the possibilities of diversion.
Obligations of the hospitals under the CSA
Under the CSA and relevant regulations, each hospital that is authorized to handle controlled substances must, among other things:
-
Maintain complete and accurate inventories and records of all regulated transactions involving controlled substances, which must be made available for inspection by the DEA;[5]
-
Have specific security controls and operating procedures in place to guard against theft and diversion;[6]
-
Notify the DEA when theft or significant loss happens;[7] and
-
Keep a system in place to identify suspicious orders of controlled substances (for hospitals with onsite pharmacies).[8]
Consequences of violating the CSA
The CSA is administered and enforced by the DEA, which is granted the authority to carry out investigations and impose sanctions to ensure that registrants comply with the recordkeeping, security, storage, and reporting requirements. The CSA’s civil penalty provisions are the primary tools the DEA uses to hold entities and persons involved in drug diversion accountable. Under the CSA, each violation may incur a civil penalty of up to $10,000,[9] which can lead to millions of dollars in civil fines.
Recent enforcement actions against hospitals
Because of their unique role in the distribution chain, hospitals are at risk for opioid diversion at every stage in the procurement, storage, dispensing, and disposal process. Any deviation from the applicable regulatory requirements may give rise to liability under the CSA. Additionally, medical professionals working at hospitals, who have easy access to controlled substances, create additional risk for opioid diversion liability. Accordingly, in recent years, hospitals have become enforcement targets and are at the front lines in the government’s battle against the opioid epidemic. Several significant civil settlements in the past two years provide examples of the enforcement trend.
University of Michigan Health System settlement
In August 2018, the University of Michigan Health System (UMHS) agreed to pay the government $4.3 million as part of a settlement resolving allegations of CSA violations. This was the largest-ever DOJ settlement with a hospital for drug diversion allegations.[10] Notably, the DEA’s investigation stemmed from the overdose deaths of a nurse and a resident of the hospital in December 2013.
Following its investigation, the DEA concluded that a number of the hospital’s practices around controlled substances violated the CSA. These “system-wide” violations included: (1) UMHS’s failure to register with the DEA 15 ambulatory care locations through which UMHS dispensed controlled substances; (2) UMHS’s distribution of controlled substances to those 15 unregistered ambulatory care locations; (3) UMHS’s failure to maintain complete and accurate records of certain controlled substances that it received, sold, delivered, or otherwise disposed of over the course of three years; (4) UMHS’s failure to comply with CSA and DEA regulations regarding recordkeeping practices, and controls and procedures to guard against theft and diversion; and (5) theft and diversion of controlled substances that occurred at UMHS.
In addition to the $4.3 million civil fine, UMHS entered into a three-year memorandum of agreement with the DEA, setting forth the measures that UMHS would take to improve its policies and practices to prevent future drug diversion.
Effingham Health System settlement
In May 2018, the Southern District of Georgia announced a settlement with Effingham Health System in which Effingham agreed to pay $4.1 million—touted as the largest settlement of its kind at the time—to resolve diversion allegations.[11] The DEA’s investigation concluded that Effingham could not account for tens of thousands of oxycodone tablets, which were believed to have been diverted over a more-than-four-year period. The DEA contended that Effingham failed to provide effective controls and procedures to guard against theft or loss, and failed to timely report suspected diversion to the DEA, thereby violating its reporting and security obligations under the CSA.
In addition to the civil fines, Effingham entered into an agreement with the DEA to memorialize a compliance and diversion detection plan to address its deficiencies in handling controlled substances. The plan included quarterly audits and detailed recordkeeping requirements.
Nantucket Cottage Hospital settlement
In May 2018, Nantucket Cottage Hospital (NCH) paid the government $50,000 to settle allegations of improper recording and handling of controlled substances.[12] Notably, there were no allegations of actual diversion at NCH; rather, the settlement stemmed from NCH’s failure to account for several controlled substances and its improper storage of prescription drugs. In addition, NCH failed to maintain invoices and other records required by the CSA, and failed to timely report the loss of controlled substances. Under the settlement arrangement, NCH agreed to allow the DEA to perform inspections of its pharmacy without a warrant and to implement new recordkeeping and security measures.
How to prevent diversion
As demonstrated by these recent settlements, the DEA often responds to triggering events, such as a report of lost controlled substances or overdose incidents, and the settlement figures are often much higher in cases involving overdose deaths or large amounts of diversion. To mitigate the risk of these high settlements, hospitals should take the following actions to prevent diversion and to respond to suspected drug diversion.
A robust compliance program is the best way to prevent drug diversion and reduce the risk of liability under the CSA. The DOJ evaluates the following four factors when determining whether to impose sanctions for civil violations of the CSA: (1) willfulness of the violation, (2) the profits generated from the violation, (3) harm to the public, and (4) the violator’s ability to pay. An effective compliance program erodes the first factor and undercuts the second and third factors. A comprehensive compliance program should include the following major aspects.
Designated personnel and oversight structure
Hospitals should establish a diversion detection/prevention system and designate specialized roles, including diversion specialists and a diversion response team that report to a diversion oversight committee. These individuals will have responsibility for overseeing and implementing the compliance program.
Controlling access
Hospitals should have in place policies and procedures for restricting managing access to controlled substances—including the personnel who have contact with controlled substances and the channels through which the drugs are dispensed and distributed. The “rule of two”—two people working together in all operations that are high risk for potential diversion—should be applied whenever possible. In addition, hospitals should conduct pre-employment screening to help filter out prospective employees who have a diversion history.
Accurate recordkeeping
The chain of custody for controlled substances should be closely monitored and accurately recorded. Receipts, invoices, and other documents regarding the handling, storage, and disposal of controlled substances should be maintained, and a policy governing document retention should be implemented.
Training and communication
Policies are only useful if employees know and understand them. A robust training program that outlines employee responsibilities should be implemented. Similarly, a proper “tone from the top,” emphasizing the importance of preventing drug diversion, should be communicated from the leadership to all employees.
Monitoring and auditing
The compliance program should include a system of regular monitoring, such as document review, data analytics, and internal audits.
Regular review and improvement
Hospital leadership should regularly review and evaluate their diversion prevention system, policies, and procedures to ensure they are updated to reflect new developments and risks in this area.
How to respond to suspected diversion
Hospitals should also be prepared to respond quickly and appropriately to any suspected drug diversion. This includes investigating allegations of misconduct, reporting violations to the government, and taking appropriate remedial or disciplinary measures. Hospitals must notify the DEA in writing of the theft or significant loss of any controlled substance within one business day of discovering the loss or theft.
Once a hospital has learned of suspected diversion or any discrepancies in its inventory, it must thoroughly investigate to determine whether any federal and state regulations have been violated. Hospitals should conduct staff interviews, review medical records, identify the causes, and analyze self-disclosure obligations and DEA reporting requirements.
If an investigation substantiates that loss or diversion has occurred, appropriate disciplinary and/or remedial action should be taken to prevent future diversion. In anticipation of a potential investigation by the DEA, hospitals should also preserve documents and evidence.
Conclusion
In the midst of the current opioid epidemic, it may not be a matter of if, but when, a hospital will be confronted with allegations of opioid diversion or CSA recordkeeping/storage violations. Hospitals should take action now to develop or strengthen their opioid diversion and detection programs and systems to reduce the risk of potential liability and ensure an appropriate response to any diversion allegations that may surface.
Takeaways
-
The opioid epidemic is one of the top enforcement priorities for the U.S. Department of Justice.
-
The civil penalty provisions under the Controlled Substances Act (CSA) are the primary tools the Drug Enforcement Administration uses to hold entities and persons involved in drug diversion accountable.
-
The government has increased its civil enforcement efforts against hospitals and health systems for violations of the CSA, often in record-breaking amounts.
-
Hospitals should take action now to develop or strengthen their opioid diversion and detection programs and systems to reduce the risk of potential liability.
-
Hospitals should also ensure an appropriate response to any diversion allegations that may surface.
